DecyfirEventCollector

Details

ID	`DecyfirEventCollector`
Provider	CYFIRMA
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Collects event logs from DeCYFIR for ingestion into Cortex XSIAM.

Once configured, the integration periodically fetches event logs from DeCYFIR’s APIs and sends them to Cortex XSIAM for ingestion and analysis.

Events are fetched in real time (starting from the moment the integration is enabled).
Each event type (Access Logs, Assets Logs, Digital Risk Keywords Logs) is fetched separately using its own pagination and limit.
The integration automatically tracks and stores the last fetched timestamp and event IDs to prevent duplication.

Configure DeCYFIR Event Collector in Cortex

Parameter	Required
Server URL	True
API Key	True
Event types to fetch	True
Maximum number of Access Logs events per fetch	False
Maximum number of Assets Logs events per fetch	False
Maximum number of Digital Risk Keywords Logs events per fetch	False
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

decyfir-get-events

Retrieve Decyfir events manually. This command is used for developing/ debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Base Command

decyfir-get-events

Input

Argument Name	Description	Required
event_types	Comma-separated list of event types to fetch. Possible values are: Access Logs, Assets Logs, Digital Risk Keywords Logs. Default is Access Logs,Assets Logs,Digital Risk Keywords Logs.	Required
should_push_events	Set this argument to True to send the fetched events to Cortex XSIAM. If False, the command will only display them in the War Room. . Possible values are: True, False. Default is False.	Required
from_date	Fetch events created after the specified time (e.g., “12 hours”, “7 days”). If not provided, defaults to “3 months”. . Default is 3 months.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — (required)
event_types_to_fetch — Event types to fetch (required)
max_access_logs_events_per_fetch — Maximum number of Access Logs events per fetch
max_assets_logs_events_per_fetch — Maximum number of Assets Logs events per fetch
max_drkl_events_per_fetch — Maximum number of Digital Risk Keywords Logs events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

decyfir-get-events
Manual command to fetch events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.

Source

DecyfirEventCollector.py DecyfirEventCollector_test.py DecyfirEventCollector.yml DecyfirEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: CYFIRMA
sectionorder:
- Connect
- Collect
commonfields:
  id: DecyfirEventCollector
  version: -1
configuration:
- defaultvalue: https://decyfir.cyfirma.com/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: true
  section: Connect
- defaultvalue: Access Logs,Assets Logs,Digital Risk Keywords Logs
  section: Collect
  display: Event types to fetch
  name: event_types_to_fetch
  options:
  - Access Logs
  - Assets Logs
  - Digital Risk Keywords Logs
  required: true
  advanced: true
  type: 16

- defaultvalue: 3000
  section: Collect
  display: Maximum number of Access Logs events per fetch
  name: max_access_logs_events_per_fetch
  required: false
  advanced: true
  type: 0

- defaultvalue: 3000
  section: Collect
  display: Maximum number of Assets Logs events per fetch
  name: max_assets_logs_events_per_fetch
  required: false
  advanced: true
  type: 0

- defaultvalue: 3000
  section: Collect
  display: Maximum number of Digital Risk Keywords Logs events per fetch
  name: max_drkl_events_per_fetch
  required: false
  advanced: true
  type: 0

- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect

- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect

description: Collects event logs from DeCYFIR for ingestion into Cortex XSIAM.
display: DeCYFIR Event Collector
name: DecyfirEventCollector
script:
  commands:
  - description: Manual command to fetch events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.
    name: decyfir-get-events
    arguments:
    - auto: PREDEFINED
      defaultValue: 'Access Logs,Assets Logs,Digital Risk Keywords Logs'
      description: Comma-separated list of event types to fetch.
      name: event_types
      predefined:
      - Access Logs
      - Assets Logs
      - Digital Risk Keywords Logs
      required: true

    - auto: PREDEFINED
      defaultValue: 'False'
      description: >
        Set this argument to True to send the fetched events to Cortex XSIAM.  If False, the command will only display them in the War Room.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true

    - description: >
        Fetch events created after the specified time (e.g., "12 hours", "7 days").  If not provided, defaults to "3 months".
      name: from_date
      required: false
      defaultValue: '3 months'

  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python

supportlevelheader: xsoar

marketplaces:
- marketplacev2
- platform

fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam